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CLAIMS 



1 1 . A virtual private telephone network for providing encrypted transport of a call 

2 across a public switched telephone network (PSTN) from a first enterprise location to a 

3 second enterprise location, said virtual private telephone network being located between one 

4 or more end-user stations at the first enterprise location and one or more end-user stations at 

5 the second enterprise location, said virtual private telephone network comprising: 

6 at least one rule associated with the first enterprise location; 

7 said at least one rule associated with the first enterprise location specifying at 

8 least one action associated with the first enterprise location to be performed based on 

9 at least one attribute of the incoming or outgoing call to/from the first enterprise 

10 location; 

11 at least one rule associated with the second enterprise location; 

1 2 said at least one rule associated with the second enterprise location specifying 

13 at least one action associated with the second enterprise location to be performed 

14 based on at least one attribute of the incoming or outgoing call to/from the second 

15 enterprise location; 

16 at least one first telephony appliance associated with the first enterprise location; 

1 7 said at least one first telephony appUance associated with the first enterprise 

18 location including means for determining said at least one attribute of the incoming 

19 or outgoing call to/from the first enterprise location; 

20 said at least one attribute being from a group including: 

21 the call direction, 

22 the call source number, 

23 the call destination number, 
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24 the call type, 

25 said call type attribute being defined as one of voice, fax, or data 

26 transfer (modem), 

27 the call date, 

28 the call time, 

29 the call duration, 

30 the identifier for the extension or direct connect line carrying the call, 

3 1 the channel through which the call is processed, 

32 the start date of the call, 

33 the start time of the call, 

34 the end date of the call, and 

35 the end time of the call; 

36 said at least one first telephony appUance associated with the first enterprise 

37 location fiirther including means for performing said at least one action associated 
3 8 with the first enterprise location specified in said at least one rule associated with the 

39 first enterprise location; 

40 said at least one action being firom a group including: 

4 1 allowing the call, 

42 denying the call, 

43 conducting the call in encrypted mode, 

44 sending a tone, 

45 sending a message, 

46 logging the call, 

47 generating a report, and 

48 providing an alert; and 
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49 at least one second telephony appliance associated with the second enterprise 

50 location; 

51 said at least one second telephony appliance associated with the second 

52 enterprise location including means for determining said at least one attribute of the 

53 incoming or outgoing call to/from the second enterprise location; 

54 said at least one attribute being from said group including: 

55 the call direction, 

56 the call source number, 

57 the call destination number, 

58 the call type, 

59 said call type attribute being defined as one of voice, fax, or data 

60 transfer (modem), 

61 the call date, 

62 the call time, 

63 the call duration, 

64 the identifier for the extension or direct connect line carrying the call, 

65 the channel through which the call is processed, 

66 the start date of the call, 

67 the start time of the call, 

68 the end date of the call, and 

69 the end time of the call; 

70 said at least one second telephony appliance associated with the second 

71 enterprise location fiirther including means for performing said at least one action 

72 associated with the second enterprise location specified in said at least one rule 

73 associated with the second enterprise location; 

74 said at least one action being from said group including: 
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75 allowing the call, 

76 denying the call, 

77 conducting the call in encrypted mode, 

78 sending a tone, 

79 sending a message, 

80 logging the call, 

8 1 generating a report, and 

82 providing an alert. 

1 2. The virtual private telephone network as defined in Claim 1 wherein said 

2 group of attributes of the incoming or outgoing call to/firom the first enterprise location 

3 fiirther includes: 

4 the trunk group through which the call is processed, 

5 the digits dialed prior to the base phone number, 

6 the digits dialed after the base phone number, 

7 the caller ID identifier, 

8 the call connect time, 

9 the keywords detected in the call content, and 
10 the digits dialed after call connect. 

1 3. The virtual private telephone network as defined in Claim 1 wherein said 

2 group of attributes of the incoming or outgoing call to/fi'om the second enterprise location 

3 fiirther includes: 

4 the trunk group through which the call is processed, 

5 the digits dialed prior to the base phone number, 

6 the digits dialed after the base phone number, 
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7 the caller ID identifier, 

8 the call connect time, 

9 the keywords detected in the call content, and 
10 the digits dialed after call connect. 

1 4. The virtual private telephone network as defined in Claim 1 wherein one of 

2 said at least one rule associated with the first enterprise effects the encryption of all calls. 

1 5. The virtual private telephone network as defined in Claim 1 wherein one of 

2 said at least one rule associated with the second enterprise effects the encryption of all calls. 

1 6. The virtual private telephone network as defined in Claim 1 further including 

2 means for performing at least one additional action associated with the first enterprise 

3 location responsive to the success or failure of said action of conducting the call in encrypted 

4 mode, said at least one additional action being fi-om a group including: 

5 allowing the call, 

6 denying the call, 

7 sending a tone, 

8 sending a message, 

9 adjusting the security poHcy, 

10 logging the call, 

1 1 generating a report, and 

12 providing an alert. 

1 7. The virtual private telephone network as defined in Claim 1 fiirther including 

2 means for performing at least one additional action associated with the second enterprise 
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3 location responsive to the success or failxire of said action of conducting the call in encrypted 

4 mode, said at least one additional action being from a group including: 

5 allowing the call, 

6 denying the call, 

7 sending a tone, 

8 sending a message, 

9 adjusting the security poUcy, 

10 logging the call, 

1 1 generating a report, and 

12 providing an alert. 

1 8. The virtual private telephone network as defined in Claim 6 wherein said 

2 action of adjusting the security policy, to be performed in association with the first enterprise 

3 location, includes changing, in accordance with said at least one rule associated with the first 

4 enterprise location, one or more actions and/or one or more additional actions associated with 

5 the first enterprise location to be performed on future incoming or outgoing calls to the one 

6 or more end-user stations at the first enterprise location. 

1 9. The virtual private telephone network as defined in Claim 7 wherein said 

2 action of adjusting the security policy, to be performed in association with the second 

3 enterprise location, includes changing, in accordance with said at least one rule associated 

4 with the second enterprise location, one or more actions and/or one or more additional 

5 actions associated with the second enterprise location to be performed on fiiture incoming or 

6 outgoing calls to the one or more end-user stations at the second enterprise location. 

1 10. The virtual private telephone network as defined in Claim 1 wherein said 
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2 action of conducting the call in encrypted mode, to be performed in association with the first 

3 enterprise location, includes creation of a VoIP-compatible packet for transport over the 

4 PSTN. 

1 1 L The virtual private telephone network as defined in Claim 1 wherein said 

2 action of conducting the call in encrypted mode, to be performed in association with the 

3 second enterprise location, includes creation of a VoIP-compatible packet for transport over 

4 the PSTN. 

1 12. The virtual private telephone network as defined in Claim 1 fiirther including: 

2 a public branch exchange (PBX) located at the first enterprise location, and 

3 means for said PBX to determine and provide one or more attributes of said at 

4 least one attribute of the incoming or outgoing call to/fi*om the first enterprise location. 

1 13. The virtual private telephone network as defined in Claim 1 fijrther including: 

2 a public branch exchange (PBX) located at the second enterprise location, and 

3 means for said PBX to determine and provide one or more attributes of said at 

4 least one attribute of the incoming or outgoing call to/firom the second enterprise location. 

1 14. The virtual private telephone network as defined in Claim 1 fiirther including: 

2 a pubUc branch exchange (PBX) located at the first enterprise location, and 

3 means for said PBX to be used to perform one or more actions of said at least 

4 one action specified in said at least one rule associated with the first enterprise location. 

1 15. The virtual private telephone network as defined in Claim 1 fiirther including: 

2 a public branch exchange (PBX) located at the second enterprise location, and 
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3 means for said PBX to be used to perform one or more actions of said at least 

4 one action specified in said at least one rule associated with the second enterprise location. 

1 16. The virtual private telephone network as defined in Claim 1 wherein said 

2 action of conducting the call in encrypted mode to be performed in association with the first 

3 enterprise location is performed without encrypting actions being taken by either the party 

4 using the one or more end-user stations at the first enterprise location or the party using the 

5 one or more end-user stations at the second enterprise location. 

1 17. The virtual private telephone network as defined in Claim 1 wherein said 

2 action of conducting the call in encrypted mode, to be performed in association with the 

3 second enterprise location, is performed without encrypting actions being taken by the party 

4 using the one or more end-user stations at the second enterprise location or the party using 

5 the one or more end-user stations at the first enterprise location. 



78 

SANANTONIO 406559vl 51263-00210 



Patent Application 
Inventors: Greg Schmid, et al. 
Attorney Docket No.: 5 1263-002 lOUSCl 



1 1 8 . A method for providing encrypted transport of a call across a public switched 

2 telephone network (PSTN) from a first enterprise location to a second enterprise location, 

3 said method being implemented between one or more end-user stations located at the first 

4 enterprise location and one or more end-user stations located at the second enterprise 

5 location, said method comprising the steps of: 

6 defining at least one rule associated with the one or more end-user stations located at 

7 the first enterprise location; 

8 said at least one rule associated with the one or more end-user stations located 

9 at the first enterprise location specifying at least one action associated with the first 

1 0 enterprise location to be performed based on at least one attribute of the incoming or 

1 1 outgoing call to/from the first enterprise location; 

1 2 defining at least one rule associated with the one or more end-user stations located at 

13 the second enterprise location; 

1 4 said at least one rule associated with the one or more end-user stations located 

15 at the second enterprise location specifying at least one action associated with the 

16 second enterprise location to be performed based on at least one attribute of the 

17 incoming or outgoing call to/from the second enterprise location; 

18 determining said at least one attribute of the incoming or outgoing call to/from the 

19 first enterprise location; 

20 said at least one attribute being from a group including: 

21 the call direction, 

22 the call source number, 

23 the call destination number, 

24 the call type, 

25 said call type attribute being defined as one of voice, fax, or data 

26 transfer (modem), 
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27 the call date, 

28 the call time, 

29 the call duration, 

30 the identifier for the extension or direct connect line carrying the call, 

31 the channel through which the call is processed, 

32 the start date of the call, 
3 3 the start time of the call, 

34 the end date of the call, and 

35 the end time of the call; 

36 determining said at least one attribute of the incoming or outgoing call to/fi-om the 

37 second enterprise location; 

38 said at least one attribute being from a group including: 

39 the call direction, 

40 the call source number, 

41 the call destination number, 

42 the call type, 

43 said call type attribute being defined as one of voice, fax, or data 

44 transfer (modem), 

45 the call date, 

46 the call time, 

47 the call duration, 

48 the identifier for the extension or direct connect line carrying the call, 

49 the charmel through which the call is processed, 

50 the start date of the call, 

5 1 the start time of the call, 

52 the end date of the call, and 
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53 the end time of the call; 

54 performing said at least one action associated with the first enterprise location and 

55 specified in said at least one rule associated with the one or more end-user stations located at 

56 the first enterprise location; 

57 said at least one action being from a group including: 

58 allowing the call, 

59 denying the call, 

60 conducting the call in encrypted mode, 

61 sending a tone, 

62 sending a message, 

63 logging the call, 

64 generating a report, and 

65 providing an alert; and 

66 performing said at least one action associated with the second enterprise location and 

67 specified in said at least one rule associated with the one or more end-user stations located at 

68 the second enterprise location; 

69 said at least one action being from a group including: 

70 allowing the call, 

7 1 denying the call, 

72 conducting the call in encrypted mode, 

73 sending a tone, 

74 sending a message, 

75 logging the call, 

76 generating a report, and 

77 providing an alert. 
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1 19. The method as defined in Claim 18 wherein said group of attributes in said 

2 step of determining said at least one attribute of the incoming or outgoing call to/fi'om the 

3 first enterprise location fiirther includes: 

4 the trunk group through which the call is processed, 

5 the digits dialed prior to the base phone number, 

6 the digits dialed after the base phone number, 

7 the caller ID identifier, 

8 the call connect time, 

9 the keywords detected in the call content, and 
10 the digits dialed after call connect. 

1 20. The method as defined in Claim 18 wherein said group of attributes in said 

2 step of determining said at least one attribute of the incoming or outgoing call to/fi-om the 

3 second enterprise location fiirther includes: 

4 the trunk group through which the call is processed, 

5 the digits dialed prior to the base phone number, 

6 the digits dialed after the base phone number, 

7 the caller ID identifier, 

8 the call connect time, 

9 the keywords detected in the call content, and 
10 the digits dialed after call connect. 

1 21. The method as defined in Claim 1 8 wherein said step of defining at least one 

2 rule associated with the one or more end-user stations located at the first enterprise location 

3 effects the encryption of all calls. 
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1 22. The method as defined in Claim 1 8 wherein said step of defining at least one 

2 rule associated with the one or more end-user stations located at the second enterprise 

3 location effects the encryption of all calls. 

1 23 . The method as defined in Claim 1 8 fiarther including the step of performing at 

2 least one additional action associated with the first enterprise location responsive to the 

3 success or failure of conducting the call in encrypted mode; 

4 said at least one additional action being firom a group including: 

5 allowing the call, 

6 denying the call, 

7 sending a tone, 

8 sending a message, 

9 adjusting the security policy, 

10 logging the call, 

1 1 generating a report, and 

12 providing an alert. 

1 24. The method as defined in Claim 1 8 fiirther including the step of performing at 

2 least one additional action associated with the second enterprise location responsive to the 

3 success or failure of conducting the call in encrypted mode; 

4 said at least one additional action being firom a group including: 

5 allowing the call, 

6 denying the call, 

7 sending a tone, 

8 sending a message, 

9 adjusting the security policy, 
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10 logging the call, 

1 1 generating a report, and 

1 2 providing an alert. 

1 25. The method as defined in Claim 18 wherein said action of adjusting the 

2 security pohcy in said step of performing said at least one action associated with the first 

3 enterprise location includes changing, in accordance with said at least one rule associated 

4 with the one or more end-user stations located at the first enterprise location, one or more 

5 actions and/or one or more additional actions to be performed on all fixture incoming or 

6 outgoing calls to/fi:om the one or more end-user stations at the first enterprise location. 

1 26. The method as defined in Claim 18 wherein said action of adjusting the 

2 security policy in said step of performing said at least one action associated with the second 

3 enterprise location includes changing, in accordance with said at least one rule associated 

4 with the one or more end-user stations located at the second enterprise location, one or more 

5 actions and/or one or more additional actions to be performed on all filture incoming or 

6 outgoing calls to/firom the one or more end-user stations at the second enterprise location. 

1 27. The method as defined in Claim 1 8 wherein said action of conducting the call 

2 in encrypted mode in said step of performing said at least one action associated with the first 

3 enterprise location includes creating a VoIP-compatible packet for transport over the PSTN. 

1 28. The method as defined in Claim 1 8 wherein said action of conducting the call 

2 in encrypted mode in said step of performing said at least one action associated with the 

3 second enterprise location includes creating a VoIP-compatible packet for transport over the 

4 PSTN. 
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1 29. The method as defined in Claim 1 8 wherein said step of determining said at 

2 least one attribute of the incoming or outgoing call to/from the first enterprise location 

3 includes: 

4 using a public branch exchange (PBX) located at the first enterprise location 

5 for determining and providing one or more attributes of said at least one attribute of the 

6 incoming or outgoing call to/from the first enterprise location. 

1 30. The method as defined in Claim 18 wherein said step of determining said at 

2 least one attribute of the incoming or outgoing call to/fi-om the second enterprise location 

3 includes: 

4 using a public branch exchange (PBX) located at the second enterprise 

5 location for determining and providing one or more attributes of said at least one attribute of 

6 the incoming or outgoing call to/firom the second enterprise location. 

1 31. The method as defined in Claim 1 8 wherein said step of performing said at 

2 least one action associated with the first enterprise location includes: 

3 using a PBX located at the first enterprise location to perform one or more 

4 actions of said at least one action associated with the first enterprise location. 

1 32. The method as defined in Claim 18 wherein said step of performing said at 

2 least one action associated with the second enterprise location includes: 

3 using a PBX located at the second enterprise location to perform one or more 

4 actions of said at least one action associated with the second enterprise location. 

1 33. The method as defined in Claim 1 8 wherein said action of conducting the call 

2 in encrypted mode in said step of performing said at least one action associated with the first 
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34. The method as defined in Claim 1 8 wherein said action of conducting the call 
in encrypted mode in said step of performing said at least one action associated with the 
second enterprise location is performed without encrypting actions being taken by either the 
party using the one or more end-user stations located at the second enterprise location or the 
party using the one or more end-user stations located at the first enterprise location. 
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1 35, A method of providing encrypted transport of a call from a first 

2 geographically separate location, across a public switched telephone network (PSTN), to a 

3 second geographically separate location, said method comprising the steps of: 

4 defining one or more rules associated with the incoming or outgoing call to/from one 

5 or more end-user stations located at the first geographically separate location; 

6 said at least one rule associated with the incoming or outgoing call to/from 

7 one or more end-user stations located at the first geographically separate location 

8 specifying one or more actions associated with the first geographically separate 

9 location to be performed based upon one or more attributes of the incoming or 

10 outgoing call to/from the first geographically separate location; 

1 1 said one or more attributes being from a group including: 

12 the call direction, 

1 3 the call source number, 

14 the call destination number, 

15 the call type, 

16 said call type attribute being defined as one of voice, fax, or data 

1 7 transfer (modem), 

18 the call date, 

19 the call time, 

20 the call duration, 

2 1 the identifier for the extension or direct connect line carrying the call, 

22 the channel through which the call is processed, 

23 the start date of the call, 

24 the start time of the call, 

25 the end date of the call, and 
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26 the end time of the call; and 

27 said one or more actions being from a group including: 

28 allowing the call, 

29 denying the call, 

30 conducting the call in encrypted mode, 

31 sending a tone, 

32 sending a message, 

33 logging the call, 

34 generating a report, and 

35 providing an alert; 

36 defining one or more rules associated v^ith the incoming or outgoing call to/from one 

37 or more end-user stations located at the second geographically separate location; 

38 said at least one rule associated with the incoming or outgoing call to/from 

39 one or more end-user stations located at the second geographically separate location 

40 specifying one or more actions associated with the second geographically separate 

41 location to be performed based upon one or more attributes of the incoming or 

42 outgoing call to/from the second geographically separate location; 

43 said one or more attributes being from a group including: 

44 the call direction, 

45 the call source number, 

46 the call destination nxunber, 

47 the call type, j 

48 said call type attribute being defined as one of voice, fax, or data 

49 transfer (modem), 

50 the call date, 

51 the call time, 
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52 the call duration, 

53 the identifier for the extension or direct connect Une carrying the call, 

54 the channel through which the call is processed, 

55 the start date of the call, 

56 the start time of the call, 

57 the end date of the call, and 

58 the end time of the call; and 

59 said one or more actions being from a group including: 

60 allowing the call, 

61 denying the call, 

62 conducting the call in encrypted mode, 

63 sending a tone, 

64 sending a message, 

65 logging the call, 

66 generating a report, and 

67 providing an alert; 

68 determining said one or more attributes of the incoming or outgoing call to/from the 

69 first geographically separate location; 

70 determining said one or more attributes of the incoming or outgoing call to/from the 

7 1 second geographically separate location; 

72 performing said one or more actions associated with the first geographically separate 

73 location in accordance with said one or more rules associated with the incoming or outgoing 

74 call to/from one or more end-user stations located at the first geographically separate 

75 location; and 

76 performing said one or more actions associated with the second geographically 

77 separate location in accordance with said one or more rules associated with the incoming or 
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79 separate location. 



1 36. The method as defined in Claim 35 wherein said group of attributes in said 

2 step of determining said one or more attributes of the incoming or outgoing call to/from the 

3 first geographically separate location further includes: 

4 the trunk group through which the call is processed, 

5 the digits dialed prior to the base phone number, 

6 the digits dialed after the base phone number, 

7 the caller ID identifier, 

8 the call connect time, 

9 the keywords detected in the call content, and 
10 the digits dialed after call connect. 

1 37. The method as defined in Claim 35 wherein said group of attributes in said 

2 step of determining said one or more attributes of the incoming or outgoing call to/from the 

3 second geographically separate location further includes: 

4 the trunk group through which the call is processed, 

5 the digits dialed prior to the base phone number, 

6 the digits dialed after the base phone number, 

7 the caller ID identifier, 

8 the call connect time, 

9 the keywords detected in the call content, and 
10 the digits dialed after call connect. 

1 38. The method as defined in Claim 35 wherein said step of defining said one or 
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2 more rules associated with the incoming or outgoing call to/from one or more end-user 

3 stations located at the first geographically separate location effects the encryption of all calls. 

1 39. The method as defined in Claim 35 wherein said step of defining said one or 

2 more rules associated with the incoming or outgoing call to/fi-om one or more end-user 

3 stations located at the second geographically separate location effects the encryption of all 

4 calls. 

1 40. The method as defined in Claim 35 fiirther including the step of performing 

2 one or more additional actions associated with the first geographically separate location 

3 responsive to the success or failure of conducting the call in encrypted mode; 

4 said one or more additional actions being fi-om a group including: 

5 allowing the call, 

6 denying the call, 

7 sending a tone, 

8 sending a message, 

9 adjusting the security pohcy, 

10 logging the call, 

1 1 generating a report, and 

1 2 providing an alert. 

1 41 . The method as defined in Claim 35 further including the step of performing 

2 one or more additional actions associated with the second geographically separate location 

3 responsive to the success or failure of conducting the call in encrypted mode; 

4 said one or more additional actions being fi-om a group including: 

5 allowing the call, 
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6 denying the call, 

7 sending a tone, 

8 sending a message, 

9 adj usting the security policy, 

10 logging the call, 

1 1 generating a report, and 

12 providing an alert. 

1 42. The method as defined in Claim 35 wherein said action of adjusting the 

2 security policy in said step of performing said one or more actions associated v^ith the first 

3 geographically separate location includes changing, in accordance with said one or more 

4 rules associated with the incoming or outgoing call to/from one or more end-user stations 

5 located at the first geographically separate location, one or more actions and/or one or more 

6 additional actions to be performed on all future incoming or outgoing calls to/fi:om the one or 

7 more end-user stations located at the first geographically separate location. 



1 43. The method as defined in Claim 35 wherein said action of adjusting the 

2 security policy in said step of performing said one or more actions associated with the second 

3 geographically separate location includes changing, in accordance with said one or more 

4 rules associated with the incoming or outgoing call to/fi'om one or more end-user stations 

5 located at the second geographically separate location, one or more actions and/or one or 

6 more additional actions to be performed on all future incoming or outgoing calls to/from the 

7 one or more end-user stations located at the second geographically separate location. 

1 44. The method as defined in Claim 3 5 wherein said action of conducting the call 

2 in encrypted mode in said step of performing said one or more actions associated with the 
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4 transport over the PSTN. 



1 45 . The method as defined in Claim 3 5 wherein said action of conducting the call 

2 in encrypted mode in said step of performing said one or more actions associated with the 

3 second geographically separate location includes creating a VoIP-compatible packet for 

4 transport over the PSTN. 

1 46. The method as defined in Claim 35 wherein said step of determining said one 

2 or more attributes of the incoming or outgoing call to/fi*om the first geographically separate 

3 location includes: 

4 using a public branch exchange (PBX) located at the first geographically 

5 separate location for determining and providing at least one attribute of said one or more 

6 attributes of the incoming or outgoing call to/fi-om the first geographically separate location. 

1 47, The method as defined in Claim 3 5 wherein said step of determining said one 

2 or more attributes of the incoming or outgoing call to/fi-om the second geographically 

3 separate location includes: 

4 using a public branch exchange (PBX) located at the second geographically 

5 separate location for determining and providing at least one attribute of said one or more 

6 attributes of the incoming or outgoing call to/firom the second geographically separate 

7 location. 

1 48. The method as defined in Claim 35 wherein said step of performing said one 

2 or more actions associated with the first geographically separate location includes: 

3 using a PBX located at the first geographically separate location to perform at 
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4 least one action of said one or more actions associated with the first geographically separate 

5 location. 

1 49. The method as defined in Claim 35 wherein said step of performing said one 

2 or more actions associated with the second geographically separate location includes: ' 

3 using a PBX located at the first geographically separate location to perform at 

4 least one action of said one or more actions associated with the second geographically 

5 separate location. 

1 50. The method as defined in Claim 35 wherein said action of conducting the call 

2 in encrypted mode in said step of performing said one or more actions associated with the 

3 first geographically separate location is performed without encrypting actions being taken by 

4 either the party using the one or more end-user stations located at the first geographically 

5 separate location or the party using the one or more end-user stations located at the second 

6 geographically separate location. 

1 51. The method as defined in Claim 3 5 wherein said action of conducting the call 

2 in encrypted mode in said step of performing said one or more actions associated with the 

3 second geographically separate location is performed without encrypting actions being taken 

4 by either the party using the one or more end-user stations located at the second 

5 geographically separate location or the party using the one or more end-user stations located 

6 at the first geographically separate location. 
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